Data brokers may be violating rules for sale of personal data

By Craig Timberg, The Washington Post

Thursday, May 9, 2013

WASHINGTON — Federal officials have intensified their scrutiny of the data brokerage industry by issuing a series of formal letters in recent days alerting companies that they may be violating federal restrictions on the collection and sale of personal information.

The letters to 10 companies -- ranging from firms that compile consumer lists for credit offers to a website that helps parents screen potential nannies -- amounted to warning shots at a large and fast-growing industry that gathers personal information and markets it to a variety of customers.

The Federal Trade Commission is probing whether some of these practices violate the Fair Credit Reporting Act, which regulates how private companies can use personal information. Individuals are supposed to know when data reports affect their eligibility for insurance, credit or employment, and they are supposed to have the opportunity to correct errors.

The FTC initiative, which involved surreptitious queries to dozens of targeted companies, is part of a broader push to curb possible abuses by data brokers, a move applauded by consumer advocates who have called for stricter limits on the use of personal data.

“It’s the initial sparks in what’s likely to become the next battle in privacy,” said Jeff Chester, executive director of the Center for Digital Democracy. “They may be using people’s data in new ways, but they could cross old laws.”

The tracking of consumers online is central to the business models of many technology firms, including Google and Facebook, both of which have been the subject of FTC investigations in recent years over privacy issues. (Washington Post Co. chief executive Donald Graham is a member of Facebook’s board.)

The data brokerage industry, however, works differently. These companies compile information from a variety of sources, including court databases and records of consumer behavior, to develop profiles of individuals that can be marketed to other companies. Typically, the subjects of these profiles have no idea how their information is collected and used.

Despite polls showing widespread public concern about privacy in the digital world, U.S. officials have had only limited success in regulating such practices because few federal statutes govern personal privacy.

The FTC last year urged Congress to pass a law forcing the industry to disclose its practices, and in December FTC officials ordered nine data brokers to explain how they assemble and sell profiles of individual consumers. Sen. John Rockefeller IV, D-W.Va., also has pushed for more information about the industry.

The warning letters issued over the past week started with a broader inquiry by FTC officials into 45 data brokers that appeared to market information whose use is restricted by the Fair Credit Reporting Act.

Agency staffers contacted the companies by phone and e-mail, posing as interested potential customers, to see if the employees of the firms were following federal rules. The warning letters noted possible violations in this initial screening and left open the possibility of future regulatory action should the companies fail to make changes.

“This should help raise awareness,” said Laura Berger, an attorney with the Bureau of Consumer Protection. She declined to comment on whether these or other companies are facing full investigations by the FTC.

Two of the companies that received warning letters appeared to offer “pre-screened” lists of potential customers for credit offers, FTC officials said, and two others appeared to offer information that could affect insurance eligibility. Six marketed information that could be used to make employment decisions.

The companies that received warning letters were 4Nannies, Brokers Data, Case Breakers, ConsumerBase, Crimcheck.com, People Search Now, U.S. Information Search, US Data Corporation and USA People Search. A 10th company was not named because receipt of the FTC letter had not been confirmed.